You’ll be able to’t cease the ‘subsequent SolarWinds’ — however you possibly can sluggish it down

It’s one of many greatest questions in cybersecurity of 2021, and it’s positive to stay on the minds of numerous companies into the subsequent 12 months, too: How do you stop a software program provide chain assault?

Such assaults have soared by 650% since mid-2020, due largely to infiltration of open supply software program, based on a current examine by Sonatype.

However an excellent larger driver of the query, in fact, has been the unprecedented assault on SolarWinds and prospects of its Orion community monitoring platform. Within the assault, risk actors compromised the platform with malicious code that was then distributed as an replace to 1000’s of shoppers, together with quite a few federal companies.

Addressing provide chain assaults

The one-year anniversary of the assault’s discovery is on Monday, however the reply for learn how to cease the “subsequent SolarWinds” assault doesn’t appear a lot clearer now than it did within the wake of the breach.

Maybe as a result of it’s the mistaken query.

Peter Firstbrook, a analysis vice chairman and analyst at Gartner, has expertise attempting to reply this query as a result of he’s been requested it so much. Nevertheless, by way of stopping the impacts from a software program provide chain assault, “the fact is, you possibly can’t,” he mentioned final month throughout Gartner’s Safety & Danger Administration Summit — Americas digital convention.

Whereas corporations ought to carry out their due diligence about what software program to make use of, the possibilities of recognizing a malicious implant in one other vendor’s software program are “extraordinarily low,” Firstbrook mentioned.

However that doesn’t imply there’s nothing to be performed.

Zero-trust segmentation

Whereas expertise that provides assured safety in opposition to the impacts of software program provide chain breaches could by no means exist, options for zero-trust segmentation will be the subsequent neatest thing, mentioned James Turgal, a vice chairman at cybersecurity consulting agency Optiv.

Previous to Optiv, Turgal spent 22 years serving within the FBI, together with as government assistant director for the bureau’s Info and Expertise Department. There, he noticed first-hand the kinds of cyber methods which can be best at disrupting attackers.

One of many greatest takeaways, Turgal mentioned, is that the harder you may make it for attackers to transit via environments, the safer you’ll be. “I’ve interviewed these guys. Most of them are lazy as hell,” he mentioned. “Making it harder for them to maneuver throughout networks is actually useful.”

That’s the place zero-trust segmentation is available in. The concept is to divide an organization’s cloud and datacenter environments into completely different segments — all the way in which right down to the extent of workload — which may every be locked down with their very own safety controls. For a enterprise, segmenting their structure on this approach — whereas additionally utilizing zero-trust authentication that repeatedly verifies a consumer’s identification — could make it “harder for the dangerous guys to maneuver via networks and transfer laterally,” Turgal mentioned.

Decreasing the blast radius

One fast-growing vendor that’s totally centered on options for zero-trust segmentation is Illumio, which achieved a $2.75 billion valuation in June in reference to its $225 million sequence F funding spherical.

Based in 2013, Illumio provides segmentation options for each datacenter and cloud environments, with the addition of its cloud-native resolution in October. The Sunnyvale, California-based firm expects to achieve “effectively north” of $100 million in annual recurring income this 12 months, based on Illumio cofounder and CEO Andrew Rubin.

In terms of segmentation, Illumio’s options had been in truth efficiently utilized by prospects that had been impacted by the SolarWinds compromise to guard in opposition to additional injury from the attackers, Rubin mentioned.

In the course of the assault marketing campaign, “we had prospects that had been operating that [SolarWinds] infrastructure and used us to section that drawback off from the remainder of their surroundings,” Rubin mentioned in an interview with VentureBeat. “I can let you know that segmentation was an efficient safety management for lowering the blast radius of that drawback.”

What Illumio provides with zero-trust segmentation is definitely very comparable in precept to the method that’s been taken to sluggish the unfold of COVID-19, he famous. “The very fact is that if we are able to cease it from spreading, that’s an unbelievably efficient technique to management the injury,” Rubin mentioned. “We knew we couldn’t stop the preliminary drawback, as a result of we already missed that. However we knew that we did have the power to vary how shortly and the way pervasively it unfold.”

In some ways, he mentioned, the cybersecurity business “is now appreciating the worth of that storyline by saying, ‘We’re going to cease a whole lot of issues — however we are able to’t cease every little thing. So let’s attempt to do a extremely good job of controlling the blast radius after they happen.’”